In a network device, such as a router or a switch, a small number of connections (aka “flows”) between two hosts may typically consume large amounts of bandwidth, and it may be desirable to identify and analyze such flows, which are sometimes called “elephant flows.” Such analysis may be useful, e.g., for analytics and/or load-balancing.